What are some common “intrusion signatures”?

There are three types of attacks: reconnaisance These include ping sweeps, DNS zone transfers, e-mail recons, TCP or UDP port scans, and possibly indexing of public web servers to find cgi holes. exploits Intruders will take advantage of hidden features or bugs to gain access to the system. denial-of-service (DoS) attacks Where the intruder attempts to crash a [...]

A typical scenario might be: Step 1: outside reconnaissance The intruder will find out as much as possible without actually giving themselves away. They will do this by finding public information or appearing as a normal user. In this stage, you really can’t detect them. The intruder will do a ‘whois’ lookup to find as much [...]

Intruders get passwords in the following ways: Clear-text sniffing: A number of protocols (Telnet, FTP, HTTP Basic) use clear-text passwords, meaning that they are not encrypted as the go over the wire between the client and the server. A intruder with a protocol analyzer can watch the wire looking for such passwords. No further effort is [...]

Software always has bugs. System Administrators and Programmers can never track down and eliminate all possible holes. Intruders have only to find one hole to break in. 1 Software bugs Software bugs are exploited in the server daemons, the client applications, the operating system, and the network stack. Software bugs can be classified in the [...]

The primary ways a intruder can get into a system: Physical Intrusion If a intruders have physical access to a machine (i.e. they can use the keyboard or take apart the system), they will be able to get in. Techniques range from special privileges the console has, to the ability to physically take apart the system [...]